Network traffic monitoring based on content data

ABSTRACT

A network monitoring device may receive, from a mediation device, flow-tap content data (generated by the mediation device based on current and/or previous investigation reports associated with flow tapping) that needs to be monitored. The network monitoring device may map the content data to a flow-tap content destination address of a content destination device in an entry of a flow-tap content filter. The network monitoring device may analyze, using the flow-tap content filter, network traffic of the network to detect a traffic flow that includes the content data. The network monitoring device may generate, based on successfully detecting a traffic flow that includes the content data, a traffic flow copy and may provide the traffic flow copy to the flow-tap content destination address, wherein the traffic flow copy is to be accessible to the content destination device to enable a context analysis of the content data.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority to Indian Provisional Application No.202041019580 entitled “NETWORK TRAFFIC MONITORING BASED ON CONTENTDATA,” filed on May 8, 2020. The entire content of which is expresslyincorporated herein by reference.

BACKGROUND

Lawful interception includes obtaining network traffic from a networkdevice pursuant to a lawful authority for the purpose of analysis and/orevidence. Such traffic may include signaling or network managementinformation or content of communications.

SUMMARY

According to some implementations, a method may include receiving, by anetwork device of a network, flow-tap content information thatidentifies content data that is to be monitored by a content destinationdevice; mapping, by the network device, the content data to a flow-tapcontent destination address of the content destination device in anentry of a flow-tap content filter, wherein the flow-tap content filteris maintained within a data structure of the network device; analyzing,by the network device and using the flow-tap content filter, networktraffic of the network to detect a traffic flow that includes thecontent data; generating, by the network device and based on detectingthe traffic flow in the network traffic, a traffic flow copy that isassociated with the traffic flow; and providing, by the network deviceand based on the flow-tap content destination address, the traffic flowcopy to the flow-tap content destination address, wherein the trafficflow copy is to be accessible to the content destination to enable acontext analysis of the content data.

According to some implementations, a network device may include one ormore memories and one or more processors to: receive, from a mediationdevice, flow-tap content information, wherein the flow-tap contentinformation identifies content data that is to be monitored by a contentdestination device; monitor, using a flow-tap content filter, networktraffic of a network to identify a traffic flow that includes thecontent data, wherein the flow-tap content filter includes an entry thatidentifies the content data and the content destination device; process,based on identifying the traffic flow within the network traffic, thetraffic flow for a transmission of the traffic flow to a traffic flowdestination of the traffic flow; generate, based on processing thetraffic flow, a traffic flow copy of the traffic flow; provide, based onthe entry, the traffic flow copy of the traffic flow to the contentdestination device; and transmit the traffic flow to the traffic flowdestination.

According to some implementations, a non-transitory computer-readablemedium may store one or more instructions. The one or more instructions,when executed by one or more processors of a network device, may causethe one or more processors to: monitor, using a flow-tap content filter,network traffic of a network to identify a traffic flow that includescontent data, wherein the flow-tap content filter includes a pluralityof sets of content data that are to be monitored by a contentdestination device; process, based on the flow-tap content filterincluding an entry associated with the content data, the traffic flowfor a transmission of the traffic flow to a traffic flow destination;generate, based on processing the traffic flow, a traffic flow copy ofthe traffic flow; and provide, based on the entry mapping the contentdata to a flow-tap content destination address, the traffic flow copy tothe content destination device, wherein the flow-tap content destinationaddress is associated with the content destination device.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1A-1D are diagrams of an example implementation described herein.

FIG. 2 is a diagram of an example environment in which systems and/ormethods described herein may be implemented.

FIGS. 3-4 are diagrams of example components of one or more devices ofFIG. 2.

FIGS. 5-7 are flowcharts of example processes relating to networktraffic monitoring based on content data.

DETAILED DESCRIPTION

The following detailed description of example implementations refers tothe accompanying drawings. The same reference numbers in differentdrawings may identify the same or similar elements.

Lawful interception (LI) is a process for obtaining network trafficrelated to an individual (a target), as authorized by a judicial oradministrative order, and providing the network traffic to a lawenforcement agency (LEA) (e.g., a police department, a governmentagency, and/or the like). The network traffic may be lawfullyintercepted at a network device (e.g., a router, a firewall, and/or thelike) via flow tapping. To perform flow tapping, the network devicecopies or mirrors the network traffic that passes through the networkdevice, forwards the original network traffic to an intendeddestination, and forwards the copied network traffic to a contentdestination device (e.g., associated with the LEA) that analyzes thecopied network traffic. Network devices are only capable of tappingnetwork traffic (e.g., packets) based on a specific set of definedparameters, such as a source Internet protocol (IP) address, adestination IP address, a source port, a destination port, and/or thelike.

However, this may cause the network device to copy all network trafficfrom a particular traffic source (e.g., associated with a target) and/orto a particular traffic destination (e.g., associated with the target oranother target), even when the network traffic does not include contentassociated with fraudulent activity, dangerous activity (e.g., terroristactivity, organized crime activity, and/or the like), and/or the like.Accordingly, the network device may consume computing resources (e.g.,processing resources, memory resources, power resources, and/or thelike) to copy network traffic that is likely not of interest to the LEA.Moreover, the content destination device may consume computing resources(e.g., processing resources, memory resources, power resources, and/orthe like) to analyze the copied network traffic to determine that thenetwork traffic does not include content associated with fraudulentactivity, dangerous activity, and/or the like.

Some implementations described herein provide a network device (e.g., amonitoring device) that is able to identify particular keywords,particular key phrases, particular word patterns, and/or the like in thecontent of network traffic to trigger a flow tapping process. In someimplementations, a mediation device (e.g., an authorized user device)may send flow-tap content information (e.g., that indicates content datathat is to trigger the flow tapping process) to the network device,which may generate an entry in a flow-tap content filter associated withthe flow-tap content information. The network device may analyze and/ormonitor network traffic using the flow-tap content filter to identify apacket that includes content that corresponds to content data of anentry in the flow-tap content filter. The network device may thereforeperform a flow tapping process for a traffic flow associated with thepacket to send a traffic flow copy to a content destination device(e.g., an authorized tapping device) associated with an LEA (e.g., forthe authorized tapping device to analyze the traffic flow copy).

In this way, the network device may perform a flow tapping process foronly network traffic that is associated with one or more packets thatinclude keywords, key phrases, word patterns, and/or the like that areassociated with fraudulent activity, dangerous activity, and/or thelike. This may conserve computing resources (e.g., processing resources,memory resources, power resources, and/or the like) of the networkdevice that would otherwise be used to perform a flow tapping processfor all network traffic associated with target traffic sources and/ortarget traffic destinations routed by the network device. This may alsoconserve computing resources (e.g., processing resources, memoryresources, power resources, and/or the like) of the content destinationdevice by allowing the content destination device to analyze onlytraffic flow copies that include keywords, key phrases, word patterns,and/or the like that are associated with fraudulent activity, dangerousactivity, and/or the like, rather than analyzing traffic flow copiesassociated with all network traffic between target traffic sourcesand/or traffic destinations routed by the network device.

FIGS. 1A-1D are diagrams of one or more examples 100 associated withnetwork traffic monitoring or storage based on content data. As shown inFIGS. 1A-1D, example(s) 100 includes a mediation device (e.g., anauthorized user device), one or more content destination devices (alsoreferred to as authorized tapping devices), one or more traffic sources(e.g., one or more origination endpoint devices), one or more trafficdestinations (e.g., one or more destination endpoint devices), and/or anetwork device (also referred to as a monitoring device, a networkmonitoring device, and/or the like). As shown in FIG. 1A, the one ormore traffic sources may transmit network traffic (e.g., Internetprotocol (IP) version 4 (IPv4) traffic, IP version 6 (IPv6 traffic),and/or the like) to the one or more traffic destinations via the networkdevice (e.g., a router, a switch, and/or the like). A mediation devicemay be a user device, a client device, and/or the like of an LEA orother authorized organization for providing flow-tap information toidentify content data of the network traffic that is transmitted betweenthe one or more traffic sources and the one or more trafficdestinations. A content destination device may be a user device, aclient device, and/or the like of the LEA, or the other authorizedorganization, that is to monitor, analyze, and/or the like, the contentdata. As shown in FIG. 1A, the network device may include a flow-tapcontent filter, a packet forwarding engine, a flow-tap interface, arouting module, and/or the like (e.g., each stored and/or maintainedwithin respective data structures of the network device).

As shown in FIG. 1B and by reference number 110, the network device mayreceive flow-tap content information from the mediation device. Forexample, a user (e.g., an LEA representative) may interact with a userinterface of the mediation device to cause the mediation device togenerate and send the flow-tap content information to the networkdevice. The flow-tap content information may identify content data(e.g., that is to be monitored and/or analyzed by the network device),source information (e.g., an address, a port, and/or the like associatedwith at least one traffic source that is to provide the content data),destination information (e.g., an address, a port, and/or the likeassociated with at least one traffic destination that is to receive thecontent data), flow-tap destination information (e.g., an address, aport, and/or the like of a content destination device of the one or morecontent destination devices), and/or the like. The content data may beassociated with a set of keywords, a set of key phrases, a set of wordpatterns, and/or the like (e.g., that are configured to trigger a flowtapping process by the network device, as described herein). In someimplementations, the mediation device may generate the content databased on current and/or previous investigation reports associated withflow tapping.

As an example, the flow-tap content information may be included in adynamic tasking control protocol (DTCP) message (e.g., a DTCP ADDmessage). As shown in FIG. 1B, a DTCP ADD message may include adestination address field (shown as X-JTap-Cdest-Dest-Address) thatindicates an address (shown as 212.25.99.82) of a traffic destinationthat is to be monitored; a destination port field (shown asX-JTap-Cdest-Dest-Port) that indicates a port (shown as 8001) of thetraffic destination that is to be monitored; a source address field(shown as X-JTap-Cdest-Source-Address) that indicates an address (shownas 208.223.208.9) of a traffic source that is to be monitored; a sourceport field (shown as X-JTap-Cdest-Source-Port) that indicates a port(shown as 49153) of the traffic source that is to be monitored; a datacontent field (X-JTap-Data-Content-Pattern) that indicates a set ofkeywords (shown as bomb, kidnap, attack, and explosion) that areconfigured to trigger a flow tapping process by the network device; aflow-tap destination field (Cdest-ID) that identifies a contentdestination tapping device (shown as cdl). Accordingly, the DTCP ADDmessage may indicate that the network device is to monitor networktraffic between the address and the port of the traffic source and theaddress and the port of the traffic destination for content that matchesor corresponds to the set of keywords, and to send relevant content tothe content destination device.

In some implementations, the network device may perform anauthentication process to determine whether the mediation device is anauthorized device (e.g., whether the mediation device is authorized toprovide flow-tap content information). For example, the mediation devicemay send credentials of the mediation device to the network device(e.g., with the flow-tap content information or as a separate datatransmission). The network device may verify, based on the credentials,that the mediation device is an authorized device. Additionally, oralternatively, the network device may send the credentials to a serverdevice (e.g., an authentication server device) that processes thecredentials to determine whether the credentials are accepted orrejected. Accordingly, the network device may receive, from the serverdevice, an authentication acceptance message (e.g., indicating that thecredentials are accepted) or an authentication rejection message (e.g.,indicating that the credentials are rejected). The network device maytherefore determine, based on receiving an authentication acceptancemessage, that the mediation device is an authorized device or determine,based on receiving an authentication rejection messages, that themediation device is not an authorized device.

In some implementations, when the network device determines that themediation device is not an authorized device, the network device maydiscard the flow-tap content information. In some implementations, whenthe network device determines that the mediation device is an authorizeddevice, the network device may store the flow-tap content informationand/or analyze network traffic based on the flow-tap contentinformation, as described herein.

As shown by reference number 120, the network device may store some orall of the flow-tap content information in the flow-tap content filter.For example, the network device may generate, based on the flow-tapcontent information, an entry (e.g., a flow-tap entry associated withthe flow-tap content information) in the flow-tap content filter. Asshown in FIG. 1B, the entry may include an entry identifier (shown asTap ID), a source field (shown as Src), a destination field (shown asDest), a content field (shown as Content), and a flow-tap destinationfield (shown in FIG. 1B as Tap Dest).

The network device may cause the source field of the entry to includesome or all of the source information of the flow-tap contentinformation. The network device may cause, when source information isnot included in the flow-tap content information, the source field toinclude an “Any” designation that indicates that the entry applies tonetwork traffic originating from any traffic source. In someimplementations, the network device may cause the destination field ofthe entry to include some or all of the destination information of theflow-tap content information. The network device may cause, whendestination information is not included in the flow-tap contentinformation, the destination field to include an “Any” designation thatindicates that the entry applies to network traffic destined for anytraffic destination.

In some implementations, the network device may cause the content fieldof the entry to include some or all of the content data included in theflow-tap content information. For example, the network device may causethe content field to include the set of keywords, the set of keyphrases, the set of word patterns, and/or the like of the content data.In some implementations, the network device may cause the flow-tapdestination field of the entry to include some or all of the flow-tapdestination information included in the flow-tap content information.The network device may cause, when flow-tap destination information isnot included in the flow-tap content information, the flow-tapdestination field to include an address, port, and/or the like of adefault content destination device. In this way, the network device maymap the content data of the flow-tap content information to a flow-tapcontent destination address in an entry of the flow-tap content filter.

As shown in FIG. 1B, the flow-tap content filter may include one or moreentries (shown with Tap_IDs Tap_1 to Tap_n, where n is greater than orequal to 1). For example, a first entry (shown as Tap_1) includes asource field that indicates a “Src_1” traffic source, a destinationfield that indicates a “Dest_1” traffic destination, a content fieldthat indicates “Content_1” content, and a tap destination field thatindicates a “Ft_dest_1” content destination device. As another example,a second entry (shown as Tap_2) includes a source field that indicates“Any” traffic source (e.g., indicating that the entry applies to networktraffic originating from any traffic source), a destination field thatindicates a “Desi_2” traffic destination, a content field that indicates“Content_2” content, and a tap destination field that indicates a“Ft_dest_2” content destination device.

In some implementations, the network device may receive, from the one ormore traffic sources, network traffic destined for the one or moretraffic destinations. As shown in FIG. 1C and by reference number 130,the network device may monitor and/or analyze the network traffic usingthe flow-tap content filter. For example, the network device may analyzea packet of the network traffic, which, as shown in FIG. 1C, may includeinformation indicating a source address “SrcAdd_1” (e.g., in a sourcefield of the packet), a destination address “DestAdd_1” (e.g., in adestination field of the packet), and/or packet content“PacketContent_2” (e.g., in a payload field of the packet).

In some implementations, the network device may determine (e.g., usingdeep packet inspection (DPI)) whether the packet matches or correspondsto an entry in the flow-tap content filter. The network device mayperform a lookup operation that involves scanning the flow-tap contentfilter for an entry that matches or corresponds to the packet. Forexample, the network device may compare (e.g., using DPI) one or morefields of the packet and one or more respective fields of the one ormore entries of the flow-tap content filter. The network device mayidentify an entry that indicates a same or similar source address as thepacket, a same or similar destination address as the packet, and/or sameor similar content of the packet. For example, as shown in FIG. 1C, asecond entry (shown as Tap_2) of a flow-tap content filter includes: asource field that indicates “Any” traffic source that corresponds to the“SrcAdd_1” traffic source indicated by the source field of the packet; adestination field that indicates a “Dest_1” traffic destination that isthe same as or similar to the “DestAdd_1” traffic destination indicatedby the destination field of the packet; and a content field thatindicates “Content 2” that is the same as or is similar to“PacketContent_2” content indicated by the content field of the packet(e.g., a set of keywords, a set of key phrases, a set of word patterns,and/or the like of the content field correspond to or match content ofthe content field of the packet).

In some implementations, the network device may identify, based on thesource address field and the destination address field of the packet, aparticular traffic source (shown in FIG. 1C as traffic source 1) and aparticular traffic destination (shown in FIG. 1C as traffic destination1) associated with the packet. As shown by reference number 140, thenetwork device may detect (e.g., based on determining that the packetmatches or corresponds to an entry in the flow-tap content filter) atraffic flow that includes the packet and/or one or more additionalpackets of the network traffic that are transmitted from the particulartraffic source to the particular second traffic source. For example, thetraffic flow may include a particular number of packets transmitted fromthe particular traffic sources to the particular traffic destinationafter the network device determines that the packet matches orcorresponds to an entry in the flow-tap content filter (e.g., the next100 additional packets; the next 1,000 additional packets; the next10,000 additional packets; and/or the like after the packet). As anotherexample, the traffic flow may include any number of packets transmitted,from the particular traffic source to the particular trafficdestination, during a time period after the network device determinesthat the packet matches or corresponds to an entry in the flow-tapcontent filter (e.g., for 1 second, 10 seconds, 20 seconds, and/or thelike after the network device determines that the packet matches orcorresponds to an entry in the flow-tap content filter).

In some implementations, the network device may notify, based ondetermining that the packet matches or corresponds to an entry in theflow-tap content filter and/or detecting the traffic flow, the contentdestination device that the packet and/or the traffic flow wasidentified. For example, the transmitting network device may send, tothe flow-tap content destination address (e.g., of the contentdestination device and/or one or more other content destination devices)indicated by the entry in the flow-tap content filter, a messageindicating that a packet and/or traffic flow matches or corresponds tothe entry. In some implementations, the network device may receive, fromthe content destination device (or another content destination device),a response indicating that the network device is to perform a flowtapping process on the traffic flow (e.g., provide a traffic flow copyto the content destination device). The network device therefore mayprocess the traffic flow as described herein in relation to FIG. 1D.Additionally, or alternatively, the network device may receive, from thecontent destination device (or another content destination device), aresponse indicating that the network device is to not perform a flowtapping process on the traffic flow. The network device may thereforeroute the traffic flow using a typical routing process.

As shown in FIG. 1D and by reference number 150, the network device(e.g., using the packet forwarding engine of the network device) mayprocess the traffic flow. In some implementations, the network devicemay process the traffic flow to generate a traffic flow copy thatcorresponds to the traffic flow. For example, the network device mayduplicate each packet of the traffic flow to generate the traffic flowcopy. The network device, based on the entry of the flow-tap contentfilter associated with the traffic flow, may include the flow-tapcontent destination address (e.g., of the content destination deviceand/or one or more other content destination devices) indicated by theentry in the traffic flow copy (e.g., the network device may encapsulateeach packet of the traffic flow copy with the flow-tap contentdestination address). As another example, the network device may extractpayload data of the traffic flow (e.g., from the respective payloadfields of the packets that comprise the traffic flow) and generate newpackets that include the extracted payload data to generate the trafficflow copy. Each new packet of the traffic flow copy may include theflow-tap content destination address (e.g., of the content destinationdevice and/or one or more other content destination devices) indicatedby the entry.

Additionally, or alternatively, the network device may process thetraffic flow to transmit the traffic flow to the traffic destinationassociated with the traffic flow (e.g., as if the network device did notperform a flow tapping process). For example, the network device maygenerate routing data indicating that the network device received thetraffic flow and/or is to route the traffic flow to the trafficdestination associated with the traffic flow. The network device mayinclude the routing data in each packet of the traffic flow (e.g., thenetwork device may encapsulate each packet of the traffic flow with therouting data).

As shown by reference number 160, the network device (e.g., using theflow-tap interface of the network device) may send the traffic flow copyto the content destination device. For example, the network device maysend the traffic flow copy to the flow-tap content destination address(e.g., of the content destination device and/or one or more othercontent destination devices) included in the packets of the traffic flowcopy. Additionally, or alternatively, the network device may identify acommunication protocol (e.g., an IP protocol, a DTCP protocol, and/orthe like) of the content destination device (e.g., for receiving atraffic flow copy) and may configure the traffic flow copy based on thecommunication protocol. The network device may therefore send thetraffic flow copy to the content destination device according to thecommunication protocol of the content destination device. In someimplementations, the network device may send the traffic flow copy tothe content destination device via a secure tunnel, such as an IPsecurity (IPsec) tunnel.

In some implementations, the content destination device may process thetraffic flow copy to determine a context analysis (e.g., determinewhether the traffic flow copy is associated with fraudulent activity,dangerous activity, and/or the like). The content destination device mayextract payload data of the traffic flow copy (e.g., from respectivepayload fields of the packets that comprise the traffic flow copy) andanalyze the payload data (e.g., using natural language processing) todetermine whether the traffic flow is associated with fraudulentactivity, dangerous activity, and/or the like.

As shown by reference number 170, the network device (e.g., using therouting module of the network device) may route the traffic flow to thetraffic destination associated with the traffic flow. The network devicemay route the traffic flow to the traffic destination without anyindication to the traffic destination that a flow-tapping processoccurred (e.g., without notifying the traffic flow destination that thetraffic flow copy was generated).

As indicated above, FIGS. 1A-1D are provided as an example. Otherexamples may differ from what is described with regard to FIGS. 1A-1D.The number and arrangement of devices shown in FIGS. 1A-1D are providedas an example. In practice, there may be additional devices, fewerdevices, different devices, or differently arranged than those shown inFIGS. 1A-1D. Furthermore, two or more devices shown in FIGS. 1A-1D maybe implemented within a single device, or a single device shown in FIGS.1A-1D may be implemented as multiple, distributed devices. Additionally,or alternatively, a set of devices (e.g., one or more devices) shown inFIGS. 1A-1D may perform one or more functions described as beingperformed by another set of devices shown in FIGS. 1A-1D.

FIG. 2 is a diagram of an example environment 200 in which systemsand/or methods described herein may be implemented. As shown in FIG. 2,environment 200 may include one or more endpoint devices 210, one ormore network devices 220, a network 230, one or more content destinationdevices 240, and a mediation device 250. Devices of environment 200 mayinterconnect via wired connections, wireless connections, or acombination of wired and wireless connections.

Endpoint device 210 includes one or more devices capable of receiving,generating, storing, processing, and/or providing information, such asinformation described herein. For example, endpoint device 210 mayinclude a mobile phone (e.g., a smart phone, a radiotelephone, and/orthe like), a laptop computer, a tablet computer, a desktop computer, ahandheld computer, a gaming device, a wearable communication device(e.g., a smart watch, a pair of smart glasses, a heart rate monitor, afitness tracker, smart clothing, smart jewelry, a head mounted display,and/or the like), a network device, or a similar type of device. In someimplementations, endpoint device 210 may receive network traffic fromand/or may provide network traffic to other endpoint devices 210 vianetwork 230 (e.g., by routing packets using network devices 220 asintermediaries).

Network device 220 includes one or more devices capable of receiving,processing, storing, routing, and/or providing traffic (e.g., a packet,other information or metadata, and/or the like) in a manner describedherein. For example, network device 220 may include a router, such as alabel switching router (LSR), a label edge router (LER), an ingressrouter, an egress router, a provider router (e.g., a provider edgerouter, a provider core router, and/or the like), a virtual router,and/or the like. Additionally, or alternatively, network device 220 mayinclude a gateway, a switch, a firewall, a hub, a bridge, a reverseproxy, a server (e.g., a proxy server, a cloud server, a data centerserver, and/or the like), a load balancer, and/or a similar device. Insome implementations, network device 220 may be a physical deviceimplemented within a housing, such as a chassis. In someimplementations, network device 220 may be a virtual device implementedby one or more computer devices of a cloud computing environment or adata center. In some implementations, a group of network devices 220 maybe a group of data center nodes that are used to route traffic flowthrough network 230.

Network 230 includes one or more wired and/or wireless networks. Forexample, network 230 may include a packet switched network, a cellularnetwork (e.g., a fifth generation (5G) network, a fourth generation (4G)network, such as a long-term evolution (LTE) network, a third generation(3G) network, a code division multiple access (CDMA) network, a publicland mobile network (PLMN), a local area network (LAN), a wide areanetwork (WAN), a metropolitan area network (MAN), a telephone network(e.g., the Public Switched Telephone Network (PSTN)), a private network,an ad hoc network, an intranet, the Internet, a fiber optic-basednetwork, a cloud computing network, or the like, and/or a combination ofthese or other types of networks.

Content destination device 240 includes one or more devices capable ofreceiving, generating, storing, processing, and/or providinginformation, such as information described herein. Content destinationdevice 240 may include a communication device and/or a computing device.For example, content destination device 240 may include a wirelesscommunication device, a user equipment (UE), a mobile phone (e.g., asmart phone or a cell phone, among other examples), a laptop computer, atablet computer, a handheld computer, a desktop computer, or a similartype of device. Content destination device 240 may be associated withone or more law enforcement authorities (e. g., police departments,government agencies, and/or the like) and may be utilized by the lawenforcement authorities to receive particular network traffic of network230 that is to be monitored for the purpose of analysis and/or evidence.Content destination device 240 may communicate with one or more otherdevices of environment 2, as described elsewhere herein.

Mediation device 250 includes one or more devices capable of receiving,generating, storing, processing, and/or providing information, such asinformation described herein. Mediation device 250 may include acommunication device and/or a computing device. For example, mediationdevice 250 may include a wireless communication device, a UE, a mobilephone (e.g., a smart phone or a cell phone, among other examples), alaptop computer, a tablet computer, a handheld computer, a desktopcomputer, or a similar type of device. Mediation device 250 may beassociated with one or more law enforcement authorities (e. g., policedepartments, government agencies, and/or the like) and may be utilizedby the law enforcement authorities to specify particular network trafficof network 230 that is to be monitored for the purpose of analysisand/or evidence. Mediation device 250 may communicate with one or moreother devices of environment 2, as described elsewhere herein.

The number and arrangement of devices and networks shown in FIG. 2 areprovided as an example. In practice, there may be additional devicesand/or networks, fewer devices and/or networks, different devices and/ornetworks, or differently arranged devices and/or networks than thoseshown in FIG. 2. Furthermore, two or more devices shown in FIG. 2 may beimplemented within a single device, or a single device shown in FIG. 2may be implemented as multiple, distributed devices. Additionally, oralternatively, a set of devices (e.g., one or more devices) ofenvironment 200 may perform one or more functions described as beingperformed by another set of devices of environment 200.

FIG. 3 is a diagram of example components of a device 300. Device 300may correspond to endpoint device 210, network device 220, contentdestination device 240, and/or mediation device 250. In someimplementations, endpoint device 210, network device 220, contentdestination device 240, and/or mediation device 250 may include one ormore devices 300 and/or one or more components of device 300. As shownin FIG. 3, device 300 may include a bus 310, a processor 320, a memory330, a storage component 340, an input component 350, an outputcomponent 360, and a communication interface 370.

Bus 310 includes a component that permits communication among thecomponents of device 300. Processor 320 is implemented in hardware,firmware, or a combination of hardware and software. Processor 320 is acentral processing unit (CPU), a graphics processing unit (GPU), anaccelerated processing unit (APU), a microprocessor, a microcontroller,a digital signal processor (DSP), a field-programmable gate array(FPGA), an application-specific integrated circuit (ASIC), or anothertype of processing component. In some implementations, processor 320includes one or more processors capable of being programmed to perform afunction. Memory 330 includes a random-access memory (RAM), a read onlymemory (ROM), and/or another type of dynamic or static storage device(e.g., a flash memory, a magnetic memory, and/or an optical memory) thatstores information and/or instructions for use by processor 320.

Storage component 340 stores information and/or software related to theoperation and use of device 300. For example, storage component 340 mayinclude a hard disk (e.g., a magnetic disk, an optical disk, amagneto-optic disk, and/or a solid state disk), a compact disc (CD), adigital versatile disc (DVD), a floppy disk, a cartridge, a magnetictape, and/or another type of non-transitory computer-readable medium,along with a corresponding drive.

Input component 350 includes a component that permits device 300 toreceive information, such as via user input (e.g., a touch screendisplay, a keyboard, a keypad, a mouse, a button, a switch, and/or amicrophone). Additionally, or alternatively, input component 350 mayinclude a sensor for sensing information (e.g., a global positioningsystem (GPS) component, an accelerometer, a gyroscope, and/or anactuator). Output component 360 includes a component that providesoutput information from device 300 (e.g., a display, a speaker, and/orone or more LEDs).

Communication interface 370 includes a transceiver-like component (e.g.,a transceiver and/or a separate receiver and transmitter) that enablesdevice 300 to communicate with other devices, such as via a wiredconnection, a wireless connection, or a combination of wired andwireless connections. Communication interface 370 may permit device 300to receive information from another device and/or provide information toanother device. For example, communication interface 370 may include anEthernet interface, an optical interface, a coaxial interface, aninfrared interface, an RF interface, a universal serial bus (USB)interface, a wireless local area interface, a cellular networkinterface, and/or the like.

Device 300 may perform one or more processes described herein. Device300 may perform these processes based on processor 320 executingsoftware instructions stored by a non-transitory computer-readablemedium, such as memory 330 and/or storage component 340. Acomputer-readable medium is defined herein as a non-transitory memorydevice. A memory device includes memory space within a single physicalstorage device or memory space spread across multiple physical storagedevices.

Software instructions may be read into memory 330 and/or storagecomponent 340 from another computer-readable medium or from anotherdevice via communication interface 370. When executed, softwareinstructions stored in memory 330 and/or storage component 340 may causeprocessor 320 to perform one or more processes described herein.Additionally, or alternatively, hardwired circuitry may be used in placeof or in combination with software instructions to perform one or moreprocesses described herein. Thus, implementations described herein arenot limited to any specific combination of hardware circuitry andsoftware.

The number and arrangement of components shown in FIG. 3 are provided asan example. In practice, device 300 may include additional components,fewer components, different components, or differently arrangedcomponents than those shown in FIG. 3. Additionally, or alternatively, aset of components (e.g., one or more components) of device 300 mayperform one or more functions described as being performed by anotherset of components of device 300.

FIG. 4 is a diagram of example components of a device 400. Device 400may correspond to endpoint device 210, network device 220, contentdestination device 240, and/or mediation device 250. In someimplementations, endpoint device 210, network device 220, contentdestination device 240, and/or mediation device 250 may include one ormore devices 400 and/or one or more components of device 400. As shownin FIG. 4, device 400 may include one or more input components 410-1through 410-B (B≥1) (hereinafter referred to collectively as inputcomponents 410, and individually as input component 410), a switchingcomponent 420, one or more output components 430-1 through 430-C (C≥1)(hereinafter referred to collectively as output components 430, andindividually as output component 430), and a controller 440.

Input component 410 may be one or more points of attachment for physicallinks and may be one or more points of entry for incoming traffic, suchas packets. Input component 410 may process incoming traffic, such as byperforming data link layer encapsulation or decapsulation. In someimplementations, input component 410 may transmit and/or receivepackets. In some implementations, input component 410 may include aninput line card that includes one or more packet processing components(e.g., in the form of integrated circuits), such as one or moreinterface cards (IFCs), packet forwarding components, line cardcontroller components, input ports, processors, memories, and/or inputqueues. In some implementations, device 400 may include one or moreinput components 410.

Switching component 420 may interconnect input components 410 withoutput components 430. In some implementations, switching component 420may be implemented via one or more crossbars, via busses, and/or withshared memories. The shared memories may act as temporary buffers tostore packets from input components 410 before the packets areeventually scheduled for delivery to output components 430. In someimplementations, switching component 420 may enable input components410, output components 430, and/or controller 440 to communicate withone another.

Output component 430 may store packets and may schedule packets fortransmission on output physical links. Output component 430 may supportdata link layer encapsulation or decapsulation, and/or a variety ofhigher-level protocols. In some implementations, output component 430may transmit packets and/or receive packets. In some implementations,output component 430 may include an output line card that includes oneor more packet processing components (e.g., in the form of integratedcircuits), such as one or more IFCs, packet forwarding components, linecard controller components, output ports, processors, memories, and/oroutput queues. In some implementations, device 400 may include one ormore output components 430. In some implementations, input component 410and output component 430 may be implemented by the same set ofcomponents (e.g., and input/output component may be a combination ofinput component 410 and output component 430).

Controller 440 includes a processor in the form of, for example, a CPU,a GPU, an APU, a microprocessor, a microcontroller, a DSP, an FPGA, anASIC, and/or another type of processor. The processor is implemented inhardware, firmware, or a combination of hardware and software. In someimplementations, controller 440 may include one or more processors thatcan be programmed to perform a function.

In some implementations, controller 440 may include a RAM, a ROM, and/oranother type of dynamic or static storage device (e.g., a flash memory,a magnetic memory, an optical memory, etc.) that stores informationand/or instructions for use by controller 440.

In some implementations, controller 440 may communicate with otherdevices, networks, and/or systems connected to device 400 to exchangeinformation regarding network topology. Controller 440 may createrouting tables based on the network topology information, may createforwarding tables based on the routing tables, and may forward theforwarding tables to input components 410 and/or output components 430.Input components 410 and/or output components 430 may use the forwardingtables to perform route lookups for incoming and/or outgoing packets.

Controller 440 may perform one or more processes described herein.Controller 440 may perform these processes in response to executingsoftware instructions stored by a non-transitory computer-readablemedium. A computer-readable medium is defined herein as a non-transitorymemory device. A memory device includes memory space within a singlephysical storage device or memory space spread across multiple physicalstorage devices.

Software instructions may be read into a memory and/or storage componentassociated with controller 440 from another computer-readable medium orfrom another device via a communication interface. When executed,software instructions stored in a memory and/or storage componentassociated with controller 440 may cause controller 440 to perform oneor more processes described herein. Additionally, or alternatively,hardwired circuitry may be used in place of or in combination withsoftware instructions to perform one or more processes described herein.Thus, implementations described herein are not limited to any specificcombination of hardware circuitry and software.

The number and arrangement of components shown in FIG. 4 are provided asan example. In practice, device 400 may include additional components,fewer components, different components, or differently arrangedcomponents than those shown in FIG. 4. Additionally, or alternatively, aset of components (e.g., one or more components) of device 400 mayperform one or more functions described as being performed by anotherset of components of device 400.

FIG. 5 is a flowchart of an example process 500 associated with networktraffic monitoring based on content data. In some implementations, oneor more process blocks of FIG. 5 may be performed by a network device(e.g., network device 220). In some implementations, one or more processblocks of FIG. 5 may be performed by another device or a group ofdevices separate from or including the network device, such as anendpoint device (e.g., endpoint device 210), a content destinationdevice (e.g., content destination device 240), a mediation device (e.g.,mediation device 250), and/or the like.

As shown in FIG. 5, process 500 may include receiving flow-tap contentinformation that identifies content data that is to be monitored by acontent destination device (block 510). For example, the network device(e.g., using processor 320, memory 330, storage component 340, inputcomponent 350, output component 360, communication interface 370, inputcomponent 410, switching component 420, output component 430, controller440, and/or the like) may receive flow-tap content information thatidentifies content data that is to be monitored by a content destinationdevice, as described above.

As further shown in FIG. 5, process 500 may include mapping the contentdata to a flow-tap content destination address of the contentdestination device in an entry of a flow-tap content filter, wherein theflow-tap content filter is maintained within a data structure of thenetwork device (block 520). For example, the network device (e.g., usingprocessor 320, memory 330, storage component 340, input component 350,output component 360, communication interface 370, input component 410,switching component 420, output component 430, controller 440, and/orthe like) may map the content data to a flow-tap content destinationaddress of the content destination device in an entry of a flow-tapcontent filter, as described above. In some implementations, theflow-tap content filter is maintained within a data structure of thenetwork device.

As further shown in FIG. 5, process 500 may include analyzing, using theflow-tap content filter, network traffic of the network to detect atraffic flow that includes the content data (block 530). For example,the network device (e.g., using processor 320, memory 330, storagecomponent 340, input component 350, output component 360, communicationinterface 370, input component 410, switching component 420, outputcomponent 430, controller 440, and/or the like) may analyze, using theflow-tap content filter, network traffic of the network to detect atraffic flow that includes the content data, as described above.

As further shown in FIG. 5, process 500 may include generating, based ondetecting the traffic flow in the network traffic, a traffic flow copythat is associated with the traffic flow (block 540). For example, thenetwork device (e.g., using processor 320, memory 330, storage component340, input component 350, output component 360, communication interface370, input component 410, switching component 420, output component 430,controller 440, and/or the like) may generate, based on detecting thetraffic flow in the network traffic, a traffic flow copy that isassociated with the traffic flow, as described above.

As further shown in FIG. 5, process 500 may include providing, based onthe flow-tap content destination address, the traffic flow copy to theflow-tap content destination address, wherein the traffic flow copy isto be accessible to the content destination device to enable a contextanalysis of the content data (block 550). For example, the networkdevice (e.g., using processor 320, memory 330, storage component 340,input component 350, output component 360, communication interface 370,input component 410, switching component 420, output component 430,controller 440, and/or the like) may provide, based on the flow-tapcontent destination address, the traffic flow copy to the flow-tapcontent destination address, as described above. In someimplementations, the traffic flow copy is to be accessible to thecontent destination device to enable a context analysis of the contentdata.

Process 500 may include additional implementations, such as any singleimplementation or any combination of implementations described belowand/or in connection with one or more other processes describedelsewhere herein.

In a first implementation, receiving the flow-tap content informationcomprises receiving the flow-tap content information from a mediationdevice, and verifying, based on an authentication process, that themediation device is authorized to utilize the flow-tap content filter,wherein the network traffic is analyzed based on verifying that themediation device is authorized to utilize the flow-tap content filter.

In a second implementation, alone or in combination with the firstimplementation, the content data is associated with a set of keywords ora set of key phrases that are configured to trigger the contentdestination device to perform the context analysis.

In a third implementation, alone or in combination with one or more ofthe first and second implementations, the flow-tap content informationidentifies destination information that is associated with a destinationthat is to receive the content data, wherein the traffic flow isdetected based on identifying that the traffic flow is to be forwardedto the destination.

In a fourth implementation, alone or in combination with one or more ofthe first through third implementations, the flow-tap contentinformation identifies source information that is associated with asource that is to provide the content data, wherein the traffic flow isdetected based on identifying that the traffic flow is associated withthe source.

In a fifth implementation, alone or in combination with one or more ofthe first through fourth implementations, providing the traffic flowcopy of the traffic flow to the flow-tap content destination addresscomprises determining a protocol associated with the content destinationdevice receiving the traffic flow copy, and providing, according to theprotocol, the traffic flow copy to the flow-tap content destinationaddress.

In a sixth implementation, alone or in combination with one or more ofthe first through fifth implementations, process 500 includes forwardingthe traffic flow to a traffic flow destination that is identified in thetraffic flow.

Although FIG. 5 shows example blocks of process 500, in someimplementations, process 500 may include additional blocks, fewerblocks, different blocks, or differently arranged blocks than thosedepicted in FIG. 5. Additionally, or alternatively, two or more of theblocks of process 500 may be performed in parallel.

FIG. 6 is a flowchart of an example process 600 associated with networktraffic monitoring based on content data. In some implementations, oneor more process blocks of FIG. 6 may be performed by a network device(e.g., network device 220). In some implementations, one or more processblocks of FIG. 6 may be performed by another device or a group ofdevices separate from or including the network device, such as anendpoint device (e.g., endpoint device 210), a content destinationdevice (e.g., content destination device 240), a mediation device (e.g.,mediation device 250), and/or the like.

As shown in FIG. 6, process 600 may include receiving, from a mediationdevice, flow-tap content information, wherein the flow-tap contentinformation identifies content data that is to be monitored by a contentdestination device (block 610). For example, the network device (e.g.,using processor 320, memory 330, storage component 340, input component350, output component 360, communication interface 370, input component410, switching component 420, output component 430, controller 440,and/or the like) may receive, from a mediation device, flow-tap contentinformation, as described above. In some implementations, the flow-tapcontent information identifies content data that is to be monitored by acontent destination device.

As further shown in FIG. 6, process 600 may include monitoring, using aflow-tap content filter, network traffic of a network to identify atraffic flow that includes the content data, wherein the flow-tapcontent filter includes an entry that identifies the content data andthe content destination device (block 620). For example, the networkdevice (e.g., using processor 320, memory 330, storage component 340,input component 350, output component 360, communication interface 370,input component 410, switching component 420, output component 430,controller 440, and/or the like) may monitor, using a flow-tap contentfilter, network traffic of a network to identify a traffic flow thatincludes the content data, as described above. In some implementations,the flow-tap content filter includes an entry that identifies thecontent data and the content destination device.

As further shown in FIG. 6, process 600 may include processing, based onidentifying the traffic flow within the network traffic, the trafficflow for a transmission of the traffic flow to a traffic flowdestination of the traffic flow (block 630). For example, the networkdevice (e.g., using processor 320, memory 330, storage component 340,input component 350, output component 360, communication interface 370,input component 410, switching component 420, output component 430,controller 440, and/or the like) may process, based on identifying thetraffic flow within the network traffic, the traffic flow for atransmission of the traffic flow to a traffic flow destination of thetraffic flow, as described above.

As further shown in FIG. 6, process 600 may include generating, based onprocessing the traffic flow, a traffic flow copy of the traffic flow(block 640). For example, the network device (e.g., using processor 320,memory 330, storage component 340, input component 350, output component360, communication interface 370, input component 410, switchingcomponent 420, output component 430, controller 440, and/or the like)may generate, based on processing the traffic flow, a traffic flow copyof the traffic flow, as described above.

As further shown in FIG. 6, process 600 may include providing, based onthe entry, the traffic flow copy of the traffic flow to the contentdestination device (block 650). For example, the network device (e.g.,using processor 320, memory 330, storage component 340, input component350, output component 360, communication interface 370, input component410, switching component 420, output component 430, controller 440,and/or the like) may provide, based on the entry, the traffic flow copyof the traffic flow to the content destination device, as describedabove.

As further shown in FIG. 6, process 600 may include transmitting thetraffic flow to the traffic flow destination (block 660). For example,the network device (e.g., using processor 320, memory 330, storagecomponent 340, input component 350, output component 360, communicationinterface 370, input component 410, switching component 420, outputcomponent 430, controller 440, and/or the like) may transmit the trafficflow to the traffic flow destination, as described above.

Process 600 may include additional implementations, such as any singleimplementation or any combination of implementations described belowand/or in connection with one or more other processes describedelsewhere herein.

In a first implementation, process 600 includes, prior to monitoring thenetwork traffic, verifying, based on credentials of the mediationdevice, that the mediation device is an authorized device, wherein thenetwork traffic is monitored based on verifying that the mediationdevice is an authorized device.

In a second implementation, alone or in combination with the firstimplementation, process 600 includes, prior to monitoring the networktraffic, identify, from the flow-tap content information, the trafficflow destination or a traffic flow source associated with the trafficflow, wherein the traffic flow is identified based on the traffic flowbeing associated with the at least one of the traffic flow destinationor the traffic flow source.

In a third implementation, alone or in combination with one or more ofthe first and second implementations, processing the traffic flowincludes extracting payload data of the traffic flow based on astructure of the traffic flow, wherein the traffic flow copy isgenerated to include the payload data, and wherein the content data is asubset of the payload data; and generating routing data for thetransmission of the traffic flow to the traffic flow destination,wherein the traffic flow destination is associated with a destinationaddress identified in the traffic flow.

In a fourth implementation, alone or in combination with one or more ofthe first through third implementations, the payload data is extractedfrom a set of traffic of the traffic flow and the set of traffic isassociated with traffic that is received during a threshold time periodafter the content data is identified.

In a fifth implementation, alone or in combination with one or more ofthe first through fourth implementations, process 600 includes, prior togenerating the traffic flow copy, notifying the content destinationdevice that the traffic flow was identified based on the content dataand receiving, from the content destination device, a tap authorizationto provide the traffic flow copy, wherein the traffic flow copy isprovided based on receiving the tap authorization.

In a sixth implementation, alone or in combination with one or more ofthe first through fifth implementations, executing the transmissionincludes providing the traffic flow to the traffic flow destinationwithout notifying the traffic flow destination that the traffic flowcopy was generated.

Although FIG. 6 shows example blocks of process 600, in someimplementations, process 600 may include additional blocks, fewerblocks, different blocks, or differently arranged blocks than thosedepicted in FIG. 6. Additionally, or alternatively, two or more of theblocks of process 600 may be performed in parallel.

FIG. 7 is a flowchart of an example process 700 associated with networktraffic monitoring based on content data. In some implementations, oneor more process blocks of FIG. 7 may be performed by a network device(e.g., network device 220). In some implementations, one or more processblocks of FIG. 7 may be performed by another device or a group ofdevices separate from or including the network device, such as anendpoint device (e.g., endpoint device 210), a content destinationdevice (e.g., content destination device 240), a mediation device (e.g.,mediation device 250), and/or the like.

As shown in FIG. 7, process 700 may include monitoring, using a flow-tapcontent filter, network traffic of a network to identify a traffic flowthat includes content data, wherein the flow-tap content filter includesa plurality of sets of content data that are to be monitored by acontent destination device (block 710). For example, the network device(e.g., using processor 320, memory 330, storage component 340, inputcomponent 350, output component 360, communication interface 370, inputcomponent 410, switching component 420, output component 430, controller440, and/or the like) may monitor, using a flow-tap content filter,network traffic of a network to identify a traffic flow that includescontent data, as described above. In some implementations, the flow-tapcontent filter includes a plurality of sets of content data that are tobe monitored by a content destination device.

As further shown in FIG. 7, process 700 may include processing, based onthe flow-tap content filter including an entry associated with thecontent data, the traffic flow for a transmission of the traffic flow toa traffic flow destination (block 720). For example, the network device(e.g., using processor 320, memory 330, storage component 340, inputcomponent 350, output component 360, communication interface 370, inputcomponent 410, switching component 420, output component 430, controller440, and/or the like) may process, based on the flow-tap content filterincluding an entry associated with the content data, the traffic flowfor a transmission of the traffic flow to a traffic flow destination, asdescribed above.

As further shown in FIG. 7, process 700 may include generating, based onprocessing the traffic flow, a traffic flow copy of the traffic flow(block 730). For example, the network device (e.g., using processor 320,memory 330, storage component 340, input component 350, output component360, communication interface 370, input component 410, switchingcomponent 420, output component 430, controller 440, and/or the like)may generate, based on processing the traffic flow, a traffic flow copyof the traffic flow, as described above.

As further shown in FIG. 7, process 700 may include providing, based onthe entry mapping the content data to a flow-tap content destinationaddress, the traffic flow copy to the content destination device,wherein the flow-tap content destination address is associated with thecontent destination device (block 740). For example, the network device(e.g., using processor 320, memory 330, storage component 340, inputcomponent 350, output component 360, communication interface 370, inputcomponent 410, switching component 420, output component 430, controller440, and/or the like) may provide, based on the entry mapping thecontent data to a flow-tap content destination address, the traffic flowcopy to the content destination device, as described above. In someimplementations, the flow-tap content destination address is associatedwith the content destination device.

Process 700 may include additional implementations, such as any singleimplementation or any combination of implementations described belowand/or in connection with one or more other processes describedelsewhere herein.

In a first implementation, the traffic flow is associated with at leastone of a particular source, of the traffic flow, that is identified inthe entry, or a particular destination, of the traffic flow, that isidentified in the entry.

In a second implementation, alone or in combination with the firstimplementation, the content data is received within flow-tap contentinformation from a mediation device, and process 700 includesgenerating, prior to monitoring the network traffic, the entry based onreceiving the flow-tap content information from a mediation device.

In a third implementation, alone or in combination with one or more ofthe first and second implementations, the traffic flow is associatedwith a time period that follows a detection of the content data.

In a fourth implementation, alone or in combination with one or more ofthe first through third implementations, providing the traffic flow copyof the traffic flow to the content destination device includesconfiguring the traffic flow copy for the transmission to the flow-tapcontent destination address based on a communication protocol of thecontent destination device and providing the traffic flow copy to thecontent destination device according to the communication protocol ofthe content destination device.

In a fifth implementation, alone or in combination with one or more ofthe first through fourth implementations, process 700 includestransmitting the traffic flow to the traffic flow destination.

Although FIG. 7 shows example blocks of process 700, in someimplementations, process 700 may include additional blocks, fewerblocks, different blocks, or differently arranged blocks than thosedepicted in FIG. 7. Additionally, or alternatively, two or more of theblocks of process 700 may be performed in parallel.

The foregoing disclosure provides illustration and description, but isnot intended to be exhaustive or to limit the implementations to theprecise form disclosed. Modifications and variations may be made inlight of the above disclosure or may be acquired from practice of theimplementations.

As used herein, the term “component” is intended to be broadly construedas hardware, firmware, or a combination of hardware and software.

As used herein, traffic or content may include a set of packets. Apacket may refer to a communication structure for communicatinginformation, such as a protocol data unit (PDU), a service data unit(SDU), a network packet, a datagram, a segment, a message, a block, aframe (e.g., an Ethernet frame), a portion of any of the above, and/oranother type of formatted or unformatted unit of data capable of beingtransmitted via a network.

A user interface may include a graphical user interface, a non-graphicaluser interface, a text-based user interface, and/or the like. A userinterface may provide information for display. In some implementations,a user may interact with the information, such as by providing input viaan input component of a device that provides the user interface fordisplay. In some implementations, a user interface may be configurableby a device and/or a user (e.g., a user may change the size of the userinterface, information provided via the user interface, a position ofinformation provided via the user interface, etc.). Additionally, oralternatively, a user interface may be pre-configured to a standardconfiguration, a specific configuration based on a type of device onwhich the user interface is displayed, and/or a set of configurationsbased on capabilities and/or specifications associated with a device onwhich the user interface is displayed.

It will be apparent that systems and/or methods described herein may beimplemented in different forms of hardware, firmware, and/or acombination of hardware and software. The actual specialized controlhardware or software code used to implement these systems and/or methodsis not limiting of the implementations. Thus, the operation and behaviorof the systems and/or methods are described herein without reference tospecific software code—it being understood that software and hardwarecan be used to implement the systems and/or methods based on thedescription herein.

Even though particular combinations of features are recited in theclaims and/or disclosed in the specification, these combinations are notintended to limit the disclosure of various implementations. In fact,many of these features may be combined in ways not specifically recitedin the claims and/or disclosed in the specification. Although eachdependent claim listed below may directly depend on only one claim, thedisclosure of various implementations includes each dependent claim incombination with every other claim in the claim set.

No element, act, or instruction used herein should be construed ascritical or essential unless explicitly described as such. Also, as usedherein, the articles “a” and “an” are intended to include one or moreitems, and may be used interchangeably with “one or more.” Further, asused herein, the article “the” is intended to include one or more itemsreferenced in connection with the article “the” and may be usedinterchangeably with “the one or more.” Furthermore, as used herein, theterm “set” is intended to include one or more items (e.g., relateditems, unrelated items, a combination of related and unrelated items,etc.), and may be used interchangeably with “one or more.” Where onlyone item is intended, the phrase “only one” or similar language is used.Also, as used herein, the terms “has,” “have,” “having,” or the like areintended to be open-ended terms. Further, the phrase “based on” isintended to mean “based, at least in part, on” unless explicitly statedotherwise. Also, as used herein, the term “or” is intended to beinclusive when used in a series and may be used interchangeably with“and/or,” unless explicitly stated otherwise (e.g., if used incombination with “either” or “only one of”).

1. A method, comprising: receiving, by a network device of a network,flow-tap content information that identifies content data that is to bemonitored by a content destination device associated with a lawenforcement authority; generating, by the network device and based onreceiving the flow-tap content information, an entry in a flow-tapcontent filter, wherein the entry identifies the content data and acorresponding flow-tap content destination address of the contentdestination device, and the flow-tap content filter is maintained withina data structure of the network device; analyzing, by the network deviceand using the flow-tap content filter, network traffic of the network todetect a traffic flow that includes the content data; generating, by thenetwork device and based on detecting the traffic flow in the networktraffic, a traffic flow copy that is associated with the traffic flow;and providing, by the network device and based on the correspondingflow-tap content destination address, the traffic flow copy to thecorresponding flow-tap content destination address, wherein the trafficflow copy is to be accessible to the content destination device toenable a context analysis of the content data.
 2. The method of claim 1,wherein receiving the flow-tap content information comprises: receivingthe flow-tap content information from a mediation device associated withthe law enforcement authority; and verifying, based on an authenticationprocess, that the mediation device is authorized to utilize the flow-tapcontent filter, wherein the network traffic is analyzed based onverifying that the mediation device is authorized to utilize theflow-tap content filter.
 3. The method of claim 1, wherein the contentdata is associated with a set of keywords or a set of key phrases thatare configured to trigger the content destination device to perform thecontext analysis.
 4. The method of claim 1, wherein the flow-tap contentinformation identifies: destination information that is associated witha destination that is to receive the content data, wherein the trafficflow is detected based on identifying that the traffic flow is to beforwarded to the destination.
 5. The method of claim 1, wherein theflow-tap content information identifies: source information that isassociated with a source that is to provide the content data, whereinthe traffic flow is detected based on identifying that the traffic flowis associated with the source.
 6. The method of claim 1, whereinproviding the traffic flow copy of the traffic flow to the correspondingflow-tap content destination address comprises: determining a protocolassociated with the content destination device receiving the trafficflow copy; and providing, according to the protocol, the traffic flowcopy to the corresponding flow-tap content destination address.
 7. Themethod of claim 1, further comprising: forwarding, and withoutindicating to a traffic flow destination that the traffic flow copy hasbeen generated, the traffic flow to the traffic flow destination.
 8. Anetwork device, comprising: one or more memories; and one or moreprocessors to: receive, from a mediation device associated with a lawenforcement authority, flow-tap content information, wherein theflow-tap content information identifies content data that is to bemonitored by a content destination device associated with the lawenforcement authority; generate, based on receiving the flow-tap contentinformation, an entry in a flow-tap content filter, wherein the entryidentifies the content data and a corresponding flow-tap contentdestination address of the content destination device; monitor, usingthe flow-tap content filter, network traffic of a network to identify atraffic flow that includes the content data; process, based onidentifying the traffic flow within the network traffic, the trafficflow for a transmission of the traffic flow to a traffic flowdestination of the traffic flow; generate, based on processing thetraffic flow, a traffic flow copy of the traffic flow; provide, based onthe entry, the traffic flow copy of the traffic flow to the contentdestination device; and transmit the traffic flow to the traffic flowdestination.
 9. The network device of claim 8, wherein the one or moreprocessors, prior to monitoring the network traffic, are to: verify,based on credentials of the mediation device, that the mediation deviceis an authorized device, wherein the network traffic is monitored basedon verifying that the mediation device is an authorized device.
 10. Thenetwork device of claim 8, wherein the one or more processors arefurther to: prior to monitoring the network traffic, identify, from theflow-tap content information, the traffic flow destination or a trafficflow source associated with the traffic flow, wherein the traffic flowis identified based on the traffic flow being associated with the atleast one of the traffic flow destination or the traffic flow source.11. The network device of claim 8, wherein the one or more processors,when processing the traffic flow, are to: extract payload data of thetraffic flow based on a structure of the traffic flow, wherein thetraffic flow copy is generated to include the payload data, and whereinthe content data is a subset of the payload data; and generate routingdata for the transmission of the traffic flow to the traffic flowdestination, wherein the traffic flow destination is associated with adestination address identified in the traffic flow.
 12. The networkdevice of claim 11, wherein the payload data is extracted from a set oftraffic of the traffic flow, wherein the set of traffic is associatedwith traffic that is received during a threshold time period after thecontent data is identified.
 13. The network device of claim 8, whereinthe one or more processors, prior to generating the traffic flow copy,are to: notify the content destination device that the traffic flow wasidentified based on the content data; and receive, from the contentdestination device, a tap authorization to provide the traffic flowcopy, wherein the traffic flow copy is provided based on receiving thetap authorization.
 14. The network device of claim 13, wherein the oneor more processors, when transmitting the traffic flow to the trafficflow destination, are to: provide the traffic flow to the traffic flowdestination without notifying the traffic flow destination that thetraffic flow copy was generated.
 15. A non-transitory computer-readablemedium storing instructions, the instructions comprising: one or moreinstructions that, when executed by one or more processors of a networkdevice, cause the one or more processors to: generate an entry in aflow-tap content filter, wherein the entry identifies content data and acorresponding flow-tap content destination address of a contentdestination device, wherein the content data is to be monitored by thecontent destination device, and the content destination device isassociated with a law enforcement authority; monitor, using the flow-tapcontent filter, network traffic of a network to identify a traffic flowthat includes the content data process, based on the entry, the trafficflow for a transmission of the traffic flow to a traffic flowdestination; generate, based on processing the traffic flow, a trafficflow copy of the traffic flow; and provide, based on the entryidentifying the content data and the corresponding flow-tap contentdestination address, the traffic flow copy to the content destinationdevice.
 16. The non-transitory computer-readable medium of claim 15,wherein the traffic flow is associated with at least one of: aparticular source, of the traffic flow, that is identified in the entry,or a particular destination, of the traffic flow, that is identified inthe entry.
 17. The non-transitory computer-readable medium of claim 15,wherein the content data is received within flow-tap content informationfrom a mediation device associated with the law enforcement authority,and the one or more instructions further cause the one or moreprocessors, to: generate, prior to monitoring the network traffic, theentry based on receiving the flow-tap content information from themediation device.
 18. The non-transitory computer-readable medium ofclaim 17, wherein the traffic flow is associated with a time period thatfollows a detection of the content data.
 19. The non-transitorycomputer-readable medium of claim 15, wherein the one or moreinstructions, that cause the one or more processors to provide thetraffic flow copy of the traffic flow to the content destination device,cause the one or more processors to: configure the traffic flow copy forthe transmission to the corresponding flow-tap content destinationaddress based on a communication protocol of the content destinationdevice; and provide the traffic flow copy to the content destinationdevice according to the communication protocol of the contentdestination device.
 20. The non-transitory computer-readable medium ofclaim 15, wherein the one or more instructions, when executed by the oneor more processors, further cause the one or more processors to:transmit, and without indicating to the traffic flow destination thatthe traffic flow copy was generated, the traffic flow to the trafficflow destination.